Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
koa-static
Advanced tools
The koa-static package is a middleware for Koa, a popular Node.js web framework. It serves static files such as HTML, CSS, JavaScript, and images from a specified directory. This is useful for serving front-end assets in a web application.
Serve Static Files
This feature allows you to serve static files from a specified directory. In this example, files from the 'public' directory will be served.
const Koa = require('koa');
const serve = require('koa-static');
const app = new Koa();
// Serve files from the 'public' directory
app.use(serve('./public'));
app.listen(3000, () => {
console.log('Server is running on port 3000');
});
Custom Options
This feature allows you to customize the behavior of the static file serving. You can set options like cache duration, serving hidden files, and specifying a default file.
const Koa = require('koa');
const serve = require('koa-static');
const app = new Koa();
// Serve files from the 'public' directory with custom options
app.use(serve('./public', {
maxage: 86400000, // Cache files for 1 day
hidden: true, // Allow hidden files to be served
index: 'index.html' // Default file to serve
}));
app.listen(3000, () => {
console.log('Server is running on port 3000');
});
The serve-static package is a middleware for Express, another popular Node.js web framework. It serves static files similarly to koa-static but is designed for use with Express. It offers similar functionalities such as serving files from a directory and customizing options like cache control.
The static-server package is a simple, standalone HTTP server for serving static files. Unlike koa-static, it is not a middleware and does not require a web framework like Koa or Express. It is useful for quickly serving static files without setting up a full web server.
The http-server package is a simple, zero-configuration command-line HTTP server. It is used to serve static files and is often used for development and testing purposes. Unlike koa-static, it is not a middleware and does not integrate with web frameworks.
Koa static file serving middleware, wrapper for koa-send
.
$ npm install koa-static
const Koa = require('koa');
const app = new Koa();
app.use(require('koa-static')(root, opts));
root
root directory string. nothing above this root directory can be servedopts
options object.maxage
Browser cache max-age in milliseconds. defaults to 0hidden
Allow transfer of hidden files. defaults to falseindex
Default file name, defaults to 'index.html'defer
If true, serves after return next()
, allowing any downstream middleware to respond first.gzip
Try to serve the gzipped version of a file automatically when gzip is supported by a client and if the requested file with .gz extension exists. defaults to true.br
Try to serve the brotli version of a file automatically when brotli is supported by a client and if the requested file with .br extension exists (note, that brotli is only accepted over https). defaults to true.extensions
Try to match extensions from passed array to search for file when no extension is sufficed in URL. First found is served. (defaults to false
)const serve = require('koa-static');
const Koa = require('koa');
const app = new Koa();
// $ GET /package.json
app.use(serve('.'));
// $ GET /hello.txt
app.use(serve('test/fixtures'));
// or use absolute paths
app.use(serve(__dirname + '/test/fixtures'));
app.listen(3000);
console.log('listening on port 3000');
koa-static
to a specific pathMIT
FAQs
Static file serving middleware for koa
The npm package koa-static receives a total of 485,022 weekly downloads. As such, koa-static popularity was classified as popular.
We found that koa-static demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 10 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.